name: Deploy olons-server production

on:
  push:
    branches:
      - pro
  workflow_dispatch:

concurrency:
  group: production-olons-server
  cancel-in-progress: false

permissions:
  contents: read

env:
  REGISTRY: git.olns.shop
  IMAGE: git.olns.shop/pro/olons_server
  SERVICE: olons-server
  DEPLOY_HOST: 145.223.69.9
  DEPLOY_USER: olns-deploy

jobs:
  deploy:
    runs-on: deploy-host
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v4

      - name: Log in to Gitea Container Registry
        env:
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          set -euo pipefail
          printf '%s' "$REGISTRY_TOKEN" | docker login "$REGISTRY" -u admin --password-stdin

      - name: Build and push image
        env:
          GITHUB_SHA: ${{ github.sha }}
        run: |
          set -euo pipefail
          SHORT_SHA="$(printf '%.12s' "$GITHUB_SHA")"
          docker build -t "${IMAGE}:pro" -t "${IMAGE}:${SHORT_SHA}" .
          docker push "$IMAGE:pro"
          docker push "$IMAGE:$SHORT_SHA"

      - name: Deploy Compose service
        env:
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          set -euo pipefail
          install -d -m 700 "$HOME/.ssh"
          KEY_FILE="$(mktemp "$HOME/.ssh/olns-deploy.XXXXXX")"
          cleanup() {
            shred -u "$KEY_FILE" 2>/dev/null || true
          }
          trap cleanup EXIT
          printf '%s\n' "$DEPLOY_SSH_KEY" > "$KEY_FILE"
          chmod 600 "$KEY_FILE"
          printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"
          chmod 600 "$HOME/.ssh/known_hosts"
          SSH_ARGS=(-i "$KEY_FILE" -o BatchMode=yes -o StrictHostKeyChecking=yes)
          printf '%s' "$REGISTRY_TOKEN" | ssh "${SSH_ARGS[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \
            "docker login git.olns.shop -u admin --password-stdin"
          ssh "${SSH_ARGS[@]}" "$DEPLOY_USER@$DEPLOY_HOST" '
            set -euo pipefail
            cd /opt/olns
            base_file=""
            for candidate in compose.yaml compose.yml docker-compose.yaml docker-compose.yml; do
              if [ -f "$candidate" ]; then
                base_file="$candidate"
                break
              fi
            done
            test -n "$base_file"

            im_container="$(docker compose -f "$base_file" ps -q im-server)"
            test -n "$im_container"
            internal_secret="$(docker inspect "$im_container" --format '"'"'{{range .Config.Env}}{{println .}}{{end}}'"'"' | sed -n '"'"'s/^INTERNAL_API_HOTGO_SECRET=//p'"'"' | head -n 1)"
            test -n "$internal_secret"

            umask 077
            {
              printf "OLONS_IM_INTERNAL_SECRET=%s\n" "$internal_secret"
              printf "OLONS_IM_BASE_URL=https://im-api.yuexuan.shop\n"
              printf "OLONS_IM_HTTP_API_URL=https://im-api.yuexuan.shop/v1/im\n"
              printf "OLONS_IM_WS_URL=wss://im-api.yuexuan.shop/v0/channels\n"
              printf "OLONS_IM_FILE_URL=https://im-api.yuexuan.shop/v0/file\n"
              printf "OLONS_IM_TENANT_CODE=default\n"
              printf "OLONS_IM_INTERNAL_SERVICE=olons-server\n"
            } > .env.olons-server
            cat > compose.olons-server-secret.yaml <<"YAML"
          services:
            olons-server:
              environment:
                OLONS_IM_INTERNAL_SECRET: ${OLONS_IM_INTERNAL_SECRET}
                OLONS_IM_BASE_URL: ${OLONS_IM_BASE_URL}
                OLONS_IM_HTTP_API_URL: ${OLONS_IM_HTTP_API_URL}
                OLONS_IM_WS_URL: ${OLONS_IM_WS_URL}
                OLONS_IM_FILE_URL: ${OLONS_IM_FILE_URL}
                OLONS_IM_TENANT_CODE: ${OLONS_IM_TENANT_CODE}
                OLONS_IM_INTERNAL_SERVICE: ${OLONS_IM_INTERNAL_SERVICE}
          YAML

            set -a
            . ./.env.olons-server
            set +a
            docker compose -f "$base_file" -f compose.olons-server-secret.yaml pull olons-server
            docker compose -f "$base_file" -f compose.olons-server-secret.yaml up -d --no-deps --wait olons-server
            docker compose -f "$base_file" -f compose.olons-server-secret.yaml exec -T olons-server sh -c '"'"'
              test -n "$OLONS_IM_INTERNAL_SECRET"
              test "$OLONS_IM_BASE_URL" = "https://im-api.yuexuan.shop"
              test "$OLONS_IM_HTTP_API_URL" = "https://im-api.yuexuan.shop/v1/im"
            '"'"'
          '